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CLOUDFLARE 


Cloudflare 
Transparency Report 


An essential part of earning and maintaining the 
trust of our customers is being transparent about 
the requests we receive from law enforcement and 
other governmental entities. To this end, Cloudflare 
publishes semi-annual updates to our Transparency 
Report on the requests we have received to disclose 
information about our customers. 
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Overview 


Require Due Process 


Any law enforcement requests that we receive must strictly adhere to the due process of law and 
be subject to judicial oversight. It is not Cloudflare's intent to make law enforcement's job any 
harder or easier. 


Respect Privacy 


It is Cloudflare's overriding privacy principle that any personal information you provide to us is 
just that: personal and private. We will not sell, rent, or give away any of your personal information 
without your consent. Our respect for our customers' privacy applies with equal force to 
commercial requests and to government or law enforcement requests. 


Provide Notice 


It is our policy to notify our customers of a subpoena or other legal process requesting their 
customer or billing information before disclosure of information, whether that legal process comes 
from the government or private parties involved in civil litigation, unless legally prohibited. 


Some things we have never done 


1. Cloudflare has never turned over our encryption or authentication keys or our customers' 
encryption or authentication keys to anyone. 


2. Cloudflare has never installed any law enforcement software or equipment anywhere 
on our network. 


3. Cloudflare has never provided any law enforcement organization a feed of our customers' 
content transiting our network. 


4. Cloudflare has never modified customer content at the request of law enforcement or 
another third party. 


5. Cloudflare has never modified the intended destination of DNS responses at the request of 
law enforcement or another third party. 


6. Cloudflare has never weakened, compromised, or subverted any of its encryption at the 
request of law enforcement or another third party. 


If Cloudflare were asked to do any of the above, we would exhaust all legal remedies, in order to 
protect our customers from what we believe are illegal or unconstitutional requests. 
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Background on the data 


The data presented below covers the period from January 1, 2021, to June 30, 2021. A request 
received in June 2021, but not processed until July 2021 will show as both “Requests received” 
and “Requests in process.” Also, requests for which we are waiting for a response from law 
enforcement before moving forward may also be reflected in “Requests in process.” The total 
number of domains affected and the total number of accounts affected refer only to requests 
which have been answered. 


Background on Requests for User Data 


Cloudflare receives requests for different kinds of data on its users from U.S. and foreign 
governments, courts and those involved in civil litigation. To provide additional transparency 
about the type of information Cloudflare might provide, we have broken down the types of 
requests we receive, as well as the legal process we require before providing particular types of 
information. We review every request for legal sufficiency before responding with data. 


We also recognize that a government’s request for data might be inconsistent with another 
government's regulatory regime for protecting the personal data of its citizens. Cloudflare 
believes that government requests for the personal data of a person that conflict with the privacy 
laws of that person’s country of residence should be legally challenged. We have yet to receive a 
government request that we have identified as posing such a conflict. 


This report does not include information about government requests for data that may be 
received by Cloudflare’s partners. 


Requests for Basic Subscriber Data 


The most frequent requests Cloudflare receives are requests for information that might be used 
to identify a Cloudflare customer. This basic subscriber data would include the information our 
customers provide at the time they sign up for our service, like name; email address; physical 
address; phone number; the means or source of payment of service; and non-content information 
about a customer's account, such as data about login times and IP addresses used to login to 

the account. Unless there is an emergency, Cloudflare requires valid legal process such as 

a subpoena or a foreign government equivalent of a subpoena before providing this type of 
information to either foreign or domestic government authorities or civil litigants. 
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U.S. Government 


Under the Electronic Communications Privacy Act (ECPA), the U.S. government can compel 
disclosure of subscriber information with a subpoena, a type of legal process that does not 
require prior judicial review. Although Cloudflare typically requires a subpoena before providing 
subscriber information, consistent with ECPA, Cloudflare may disclose information without delay 
to law enforcement if the request involves imminent danger of death or serious injury to any 
person. Cloudflare will evaluate emergency disclosure requests on a case-by-case basis as we 
receive them. For emergency disclosure requests, we request that law enforcement obtain legal 
process when time permits. 


Beyond subpoenas issued under ECPA, some U.S. government agencies may issue administrative 
subpoenas for subscriber data. Cloudflare has received a number of such subpoenas from the 
Securities and Exchange Commission (SEC). 


National Security Process 


The U.S. government can also issue a variety of different types of national security requests for 
data. Under the Foreign Intelligence Surveillance Act (FISA), the U.S. government may apply for 
court orders from the FISA Court to, among other actions, require U.S. companies to provide 
users’ personal information. The U.S. government can also issue National Security Letters (NSLs), 
which are similar to subpoenas, for subscriber and limited non-content data. Both FISA court 
orders and NSLs typically come with a non-disclosure obligation. 


Non-disclosure Orders 


Legal process seeking subscriber data may come with court or administrative orders restricting 
Cloudflare’s ability to notify our customers. Cloudflare has long had concerns about these types 
of non-disclosure obligations, particularly when they are indefinite in nature. In 2013, after 
receiving an NSL, Cloudflare objected to an administratively imposed gag which prohibited 
Cloudflare from disclosing information about this NSL to anyone other than our attorneys and 

a limited number of our staff, under threat of criminal liability. Cloudflare provided no customer 
information subject to NSL-12-358696; but the NSL’s nondisclosure provisions remained in effect 
for nearly four years, until December 2016, after which Cloudflare disclosed receipt of the NSL, 
along with a redacted copy of the NSL 


Governments Outside the United States 


Cloudflare responds to requests from governments outside the United States for all types of 
information, including subscriber data, that are issued through a U.S. court by way of diplomatic 
process like a mutual legal assistance treaty (MLAT) request. The information produced to 
governments outside the United States in response to these requests is the same as would be 
produced to the U.S. government in response to a similar U.S. court order. 
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Cloudflare evaluates on a case-by-case basis requests for subscriber information from 
governments outside the United States that do not come through the U.S. court system. 
Cloudflare may, in our discretion, provide subscriber data in response to a local equivalent of a 
subpoena, provided that the request complies with local law, and is consistent with international 
norms and Cloudflare’s privacy and human rights policies. 


In March 2018, the United States passed the Clarifying Lawful Overseas Use of Data (CLOUD) Act, 
which permits the U.S. government to enter into Executive Agreements with other governments 

to allow direct law enforcement access for both governments to data stored in the other country 
to investigate and prosecute certain crimes. The law permits countries that enter into such 
Agreements with the United States to seek content data from U.S. companies directly, using that 
country’s legal process, rather than requiring the country’s law enforcement agencies to work with 
U.S. law enforcement to get U.S. legal process such as a court order. 


Cloudflare believes that government access to data must be consistent with the principles of rule 
of law and due process, including prior independent judicial review of requests for content; that 
users are entitled to notice when the government accesses their data; and that companies must 
have procedural mechanisms to raise legal challenges to access requests. Whether inside or 
outside the United States, we will fight law enforcement requests that we believe are overbroad, 
illegal, inconsistent with human rights principles, or wrongly issued, or that unnecessarily restrict 
our ability to be transparent with our users. 


Civil Process 


Cloudflare responds to legal process requesting subscriber data from civil litigants, such as 
subpoenas issued pursuant to the Digital Millennium Copyright Act (DMCA) seeking information 
on users alleged to be infringing copyright. 


Emergency Requests 


Cloudflare receives emergency requests for data from time to time from law enforcement and 
governments. Cloudflare will respond on a voluntary basis if we have a good faith belief that there 
is an emergency involving the danger of death or serious physical injury. 


Requests for Other Non-Content Data 


Beyond requests for the types of subscriber data described above, Cloudflare sometimes receives 
court orders for transactional data related to a customer’s account or a customer’s website, such 
as logs of the IP addresses visiting a customer’s website or the dates and times a customer may 
have contacted support. Because Cloudflare retains such data for only a limited period of time, 
Cloudflare rarely has responsive data to provide to such requests. 
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Court Orders 


Court orders are requests for data issued by a judge or magistrate. With a court order, Cloudflare 
may provide both the basic subscriber information that might be provided in response to a 
subpoena and other non-content information. The court orders that Cloudflare receives typically 
include a temporary non-disclosure requirement. 


Pen Register Trap and Trace 


Cloudflare periodically receives pen register/trap and trace orders, issued by a court, seeking 
real-time disclosure of non-content information, such as the IP addresses of visitors to a website. 
We provide limited forward looking data in response to those requests. 


Requests for Content Data 


Cloudflare is not generally a hosting provider or an email service provider and does not have 
customer content -- like email or other types of customer-generated material -- in the traditional 
sense. In the rare instances where law enforcement has sought content such as abuse complaints 
or support communications, Cloudflare has insisted on a search warrant for those electronic 
communications, consistent with the principles laid out in U.S. v. Warshak. To date, we have 
received no such warrants. 


Search Warrants 


Search warrants require judicial review, a finding of probable cause, inclusion of a location to 
be searched, and a detail of items requested. Although we have received a number of search 
warrants, as noted above, we have not had customer content to provide in response to those 
warrants. 


Wiretap 


A wiretap order is a court order that requires a company to turn over the content of 
communications in real time. Law enforcement must comply with very detailed legal requirements 
to obtain such an order. Cloudflare has never received such a wiretap order. 


National Security Process 


The U.S. government may apply for court orders from the FISA Court to require U.S. companies 
to turn over the content of users’ communications to the government. As noted above, Cloudflare 
does not have access to the type of traditional customer content generally sought by FISA court 
orders. Because the public reporting of all national security process is highly regulated, 

if Cloudflare were to receive such an order, it would be reported as part of a combined number 
of NSLs and content and non-content FISA orders, in a band of 250, beginning with 0-250. 
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Background on Requests for 
Content Removal or Blocking 


Cloudflare runs a global network that provides security and performance enhancements for 
Internet-facing websites and applications around the world. Because Cloudflare’s infrastructure 
sits between our customers’ websites and Internet users in order to protect those websites from 
direct attack and serve requests to and from those servers, Cloudflare’s nameservers may appear 
in the WHOIS records and Cloudflare’s IP addresses may appear in the DNS records for websites 
using our service. 


As the point of contact listed on relevant records, Cloudflare receives requests to remove content 
from our network from copyright holders alleging infringement, or from governments taking the 
position that the content is unlawful. As Cloudflare cannot remove material from the Internet 

that is hosted by others, we generally forward requests for removal of content to the website 
hosting provider, who has access to the website content and the ability to address the underlying 
concern. 


A small but growing number of Cloudflare’s products include storage. Cloudflare has different 
terms of service and a different process for responding to abuse complaints about content stored 
on our network, as opposed to transiting or being temporarily cached on the network, reflecting 
the distinct legal requirements and expectations for definitively hosted content. If Cloudflare 
receives a valid takedown request content that is stored on the Cloudflare network, Cloudflare 
will disable access to the content, as appropriate. This report includes details on the requests we 
receive to disable access to content stored on our network. 


Requests for Content Removal Due to Copyright 


Cloudflare carefully reviews requests that we receive for content removal under the Digital 
Millennium Copyright Act (DMCA). If we receive a DMCA complaint regarding the limited amount 
of content that we host, we will notify the user of the alleged infringement, allow for the user to 
provide a counter notice contesting the infringement allegation, and remove content consistent 
with the DMCA. 


Requests for Content Blocking 


Cloudflare also may receive written requests from law enforcement, government agencies, or 
foreign courts to block access to content based on the local law of the jurisdiction. Because of 
the significant potential impact on freedom of expression, Cloudflare will evaluate each content 
blocking request on a case-by-case basis, consistent with our human rights policy, analyzing the 
factual basis and legal authority for the request. 


If we determine that the order is valid and requires Cloudflare action, we may limit blocking 
of access to the content to those areas where it violates local law, a practice known as “geo- 
blocking”. We will attempt to clarify and narrow overbroad requests when possible. 
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Requests for Uniform Domain-Name Dispute Resolutions 


As an ICANN-accredited domain registrar, Cloudflare follows ICANN’s Uniform Domain-Name 
Dispute Resolution Policy (UDRP) for trademark-based domain name disputes. Consistent with the 
policy, Cloudflare will, upon receipt of a valid UDRP verification request from an ICANN approved 
dispute board: (1) Lock the disputed domain name(s) to prevent modification to the registrant and 
registrar information for the duration of the dispute, and (2) Unmask or provide the underlying 
WHOIS information to the dispute board. 


Upon receipt of a valid notice of decision from an ICANN approved dispute board, and based 

on the decision, Cloudflare will, as appropriate, unlock the domain to allow the Respondent to 
manage the domain, transfer the domain to the Complainant at a predetermined time to allow the 
Respondent to initiate a legal dispute with their local legal system that is within the jurisdiction of 
the Registrar, or delete the domain. 


The Data 


The data presented below is updated through June 30, 2021. A request received in June 2021, but not 
processed until July 2021 will show as both “Requests received” and “Requests in process.” Also, 
requests for which we are waiting for a response from law enforcement before moving forward may 
also be reflected in “Requests in process.” The “Total # of domains affected” and the “Total number 
of accounts affected” refer only to requests which have been answered. 


U. S. Requests for User Data 


U.S. Government Criminal Subpoenas 


This category includes U.S. legal process in connection with a criminal investigation that does 
not have prior judicial review, including but not limited to grand jury subpoenas, U.S. government 
attorney issued subpoenas, and case agent issued summonses. 
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Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 183 152 0 332 4402* 
2020 (2H) 33 11* 0 33* 73* 
2020 (1H) 22 7 0 20* 125* 
2019(2H) 11* 7* 0 92* 78* 
2019(1H) 20 8 0 5* 53* 
2018 (2H) 21* 10* 0 12 72* 
2018 (1H) 23 14 0 24 172 
2017 (2H) 22 13 2 6 846 
2017 (1H) 21 8 1 59 51 
2016 (2H) 9 6 0 17 2586 
2016 (1H) 12 96 
2015 (2H) 26 458 
2015 (1H) 12 139 
2014 (2H) 12 393 
2014 (1H) 11 12 

2013 18 17 

* These numbers were adjusted in December 2021 to correct a ministerial error. 
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2018 (1H) 2018 (1H) 
2017 (2H) 2017 (2H) 
2017 (1H) 2017 (1H) 
2016 (2H) 2016 (2H) 
2016 (1H) 2016 (1H) 
2015 (2H) 2015 (2H) 
2015 (1H) 2015 (1H) 
2014 (2H) 2014 (2H) 
2014 (1H) 2014 (1H) 
2013 2013 
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U.S. Administrative Subpoenas 


Administrative subpoenas are legal process issued directly by a U.S. government agency 
without judicial oversight like those issued by the Securities and Exchange Commission and 
the Federal Trade Commission. 


Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 0 0 0 0 0 
2020 (2H) 1* 0* 0 0 0 
2020 (1H) 2* 2* 0 10 7 
2019 (2H) 1* 1* 0 1* T* 
2019 (1H) 0* 0* 0 0 0 
2018 (2H) N/A 0 0 0 0 


* These numbers were adjusted in December 2021 to correct a ministerial error. 


Civil Subpoenas 


This category includes subpoenas for subscriber information received from civil litigants, such as 
subpoenas issued pursuant to the Digital Millennium Copyright Act (DMCA). 


Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 45* 45* 0 325* 35382* 
2020 (2H) 47* 42* 0 952* 517* 

2020 (1H) 31 30 0 548* 79* 
2019 (2H) 51* 51* 0 629* 461* 
2019 (1H) 28 27 0 80 209 
2018 (2H) 21 21 0 40 3,588 


* These numbers were adjusted in December 2021 to correct a ministerial error. 


Accounts affected Domains affected 
2021 (1H) 2021 (1H) 
2020 (2H) 2020 (2H) 
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2019 (2H) 2019 (2H) 
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Court Orders 


This category includes any order issued by a judge or magistrate, including but not limited to 


18 U.S.C. § 2703(d), 18 U.S.C. § 2705(b), and MLAT orders. Orders which may fall under a more 


specific category such as search warrants or pen register / trap and trace orders will be reported 


under the more specific category and not counted here. 


Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 18 40 
2020 (2H) 136* 873* 
2020 (1H) 148* 328* 
2019 (2H) 92* 325* 
2019 (1H) 132* 1446* 
2018 (2H) 57* 19222* 
2018 (1H) 95 4400 
2017 (2H) 79 7354 
2017 (1H) 75* 3711* 
2016 (2H) 60 2338 
2016 (1H) 47 6465 
2015 (2H) 14 668 
2015 (1H) 50 2120 
2014 (2H) 24 23 5 167 802 
2014 (1H) 22 21 1 57 290 

2013 28 27 0 47 266 

* These numbers were adjusted in December 2021 to correct a ministerial error. 
Accounts affected Domains affected 
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Mutual Legal Assistance Treaty 


Our reporting on U.S. court orders above includes orders requested by foreign governments through 
the MLAT process. To provide additional granularity on MLAT requests, we have also identified those 
court orders clearly identified to be requested from a foreign government through the MLAT process. 


Year Country Received Answered In process Accounts affected | Domains affected 
2021 (1H) France 1 1 0 1 1 
Netherlands 1 1 0 2 1 
Switzerland 2 2 0 4 3 
Poland 2 2 0 2 2 
2020 (2H) UK 1 1 0 2 1 
Mexico 1 1 0 1 1 
Spain 1 1 0 1 1 
North Macedonia 2 2 0 4 2 
Poland 3* 2 0 186* 4* 
France 1 1 0 3 1 
2020 (1H) Poland 3 3 0 14 5 
Germany 1 1 0 1 1 
Bosnia 1 1 0 14 7 
South Korea 1 (0) 0 0 0 
Romania 1 0 0 0 0 


* These numbers were adjusted in December 2021 to correct a ministerial error. 
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Year Country Received Answered In process Accounts affected | Domains affected 
2019 (2H) Poland 1 1 0 7 1 
Peru 1 1 0 1 1 
2019 (1H) Poland 2 0 0 0 [0] 
Japan 2 2 [0] 47* 4* 
France 1 1 0 1 1 
Greece 1 0 0 0 0 
Sweden 1 1 0 2* 3* 


* These numbers were adjusted in December 2021 to correct a ministerial error. 
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2018 (2H) Poland 2 1 0 1 1 
Portugal 2 1 0 1 50 
Sweden 5 3 0 3 11 
2018 (1H) Austria 1 0 0 0 0 
Poland 2 1 0 1 6 
Russia 1 1 0 1 11 
Sweden 2 1 0 1 4 
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Pen Register/Trap and Trace (PRTT) Orders 


This category includes only pen register/trap and trace orders issued by the court for real-time 


disclosure of non-content information, including IP address information. 


Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 7 7 0 19* 23* 
2020 (2H) 4* 4* 0 4* 11* 
2020 (1H) 4 4 0 8* 10* 
2019 (2H) 5 5 0 12* 8* 
2019 (1H) 0 0 0 0 0 
2018 (2H) 1 1 0 6 6 
2018 (1H) 1 1 0 1 1 
2017 (2H) 0 0 0 0 0 
2017 (1H) 0 0 0 0 0 
2016 (2H) 1 1 0 1 1 
2016 (1H) 2 2 0 7 7 
2015 (2H) 0 0 0 0 0 
2015 (1H) 1 1 0 1 2 
2014 (2H) 1 1 0 4 6 
2014 (1H) 0 0 0 0 0 

2013 1 1 0 1 1 

* These numbers were adjusted in December 2021 to correct a ministerial error. 
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Emergency Requests 


This category includes emergency requests for data. 


Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 2 2 0 1 1* 
2020 (2H) 9* 6* 0 3 3 
2020 (1H) 5 3 0 3 3 
2019 (2H) 5* 1 0 1 1 
2019 (1H) 5 5 0 1* 1* 
* These numbers were adjusted in December 2021 to correct a ministerial error. 
Accounts affected Domains affected 
2021 (1H) 2021 (1H) 
2020 (2H) 2020 (2H) 
2020 (1H) 2020 (1H) 
2019 (2H) 2019 (2H) 
2019 (1H) 2019 (1H) 
0 1 0 1 2 3 


National Security Process 


What we can say about either FISA court orders or NSL that we receive is highly regulated, and 

depends on exactly how we report the information. Current guidelines on reporting, codified as part 
of the USA FREEDOM Act, allow companies to disclose the combined number of NSLs and both 

content and non-content FISA orders as a single number in bands of 250, starting with 0-249. 


Year Received Answered 
2021 (1H) 0-249 0-249 
2020 (2H) 0-249 0-249 
2020 (1H) 0-249 0-249 
2019 (2H) 0-249 0-249 
2019 (1H) 0-249 0-249 
2018 (2H) 0-249 0-249 
2018 1H) 0-249 0-249 
2017 (2H) 0-249 0-249 
2017 (1H) 0-249 0-249 
2016 (2H) 0-249 0-249 
2016 (1H) 0-249 0-249 
2015 (2H) 0-249 0-249 
2015 (1H) 0-249 0-249 
2014 (2H) 0-249 0-249 
2014 (1H) 0-249 0-249 

2013 0-249 0-249 

2012 0-249 0-249 
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Search Warrants 


This category includes only search warrants which require judicial review, probable cause, and 


inclusion of a location to be searched and a detail of items requested. As noted above, although 
we processed these search warrants, we have not had customer content to provide in response. 


Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 8 6 0 2 2 
2020 (2H) 9* 5 0 14 6 
2020 (1H) 6* 5 0 17* 6 
2019 (2H) 3 3 0 5* 4* 
2019 (1H) 5* 5* 0 7 5 
2018 (2H) 1 0 0 [0] 0 
2018 (1H) 4 2 0 18 248 
2017 (2H) 1 1 0 0 0 
2017 (1H) 1 0 0 0 0 
2016 (2H) 1 1 0 1 5 
2016 (1H) 4* 4* 0 4* 85* 
2015 (2H) 5 5 (0) 6 35 
2015 (1H) 3 3 0 8 127 
2014 (2H) 2 2 1 3 68 
2014 (1H) 1 1 0 1 36 

2013 3 2 0 2 40 

* These numbers were adjusted in December 2021 to correct a ministerial error. 
Accounts affected Domains affected 
2021 (1H) 2021 (1H) 
2020 (2H) 2020 (2H) 
2020 (1H) 2020 (1H) 
2019 (2H) 2019 (2H) 
2019 (1H) 2019 (1H) 
2018 (2H) 2018 (2H) 
2018 (1H) 2018 (1H) 
2017 (2H) 2017 (2H) 
2017 (1H) 2017 (1H) 
2016 (2H) 2016 (2H) 
2016 (1H) 2016 (1H) 
2015 (2H) 2015 (2H) 
2015 (1H) 2015 (1H) 
2014 (2H) 2014 (2H) 
2014 (1H) 2014 (1H) 
2013 2013 
0 5 10 15 20 50 100 150 200 250 


1888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com 


CLOUDFLARE TRANSPARENCY REPORT 


Wiretap Orders 


This category includes only wiretap orders that were issued by a court. 
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Received 


Answered 


In process 


Accounts affected 
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Non-U.S. Requests for User Data 


This category includes requests for user information from governments outside the United States 


that do not come through the U.S. court system. 


In June 2021, the Metropolitan Police Service in London served a production order on Cloudflare 
Ltd., Cloudflare's UK subsidiary, seeking the production of customer records associated with 
certain websites using Cloudflare's services. Cloudflare opposed the order as improper because 
the records sought were held by Cloudflare, Inc. in the United States, and any production order 
should have been gone through an MLAT or similar process. On September 14, the Southwark 
Crown Court granted Cloudflare's application to discharge the production order, finding that 
Cloudflare, Ltd was not properly subject to the order because it did not have possession or 
control of the records. 
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CLOUD Act 


United Kingdom (UK). On October 3, 2019, the US and UK signed an Executive Agreement under 
the CLOUD Act, which went into effect on July 8, 2020. Cloudflare has not received any legal 
requests from the UK pursuant to this agreement. 


Australia. Although the US and Australia have been negotiating a bilateral agreement under 
the CLOUD Act, no agreement has been signed as of the date of this transparency report. On 
June 24, 2021, Australia passed legislation that establishes a framework to give effect to future 
agreements for cross-border access to electronic information and communications data. 


Requests for Content Removal or Blocking 


The data presented below is for the period from January 1, 2021 to June 30, 2021. A request 
received in June 2021, but not processed until July 2021 will show as both “Requests received” 
and “Requests in process.” 


Requests for Content Removal Due to Copyright 


The DMCA contemplates different procedures for hosted content than for cached content, and it 
contemplates no such procedures for transiting content. As described in more detail above, when 
Cloudflare receives DMCA requests to remove content that we do not host on our network, we 
forward those requests to the hosting provider storing the content in question. This report reflects 
DMCA requests directed towards content stored on Cloudflare’s network. 


Year Received Answered In process Accounts affected Domains affected 
2021 (1H) 4 367* 
2020 (2H) 12* 136* 
2020 (1H) 1* 4* 
2019 (2H) 19* 33* 
2019 (1H) 10* 179* 
2018 (2H) 1 9* 
* These numbers were adjusted in December 2021 to correct a ministerial error. 
Accounts affected Domains affected 
2021 (1H) 2021 (1H) 
2020 (2H) 2020 (2H) 
2020 (1H) 2020 (1H) 
2019 (2H) 2019 (2H) 
2019 (1H) 2019 (1H) 
2018 (H2) 2018 (H2) 
0 50 100 150 200 250 0 100 200 300 400 


Requests for Content Blocking 


Cloudflare received no new court orders for content blocking during the reporting period. 
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UDRP Requests 


This category includes valid UDRP verification requests Cloudflare received from an ICANN- 
approved dispute board. 


Year Received Answered In process Accounts affected Domains affected 

2021 (1H) 7 7 0 7 7 

2020 (2H) 4 4 0 4 5 

2020 (1H) 3 3 0 5 4 

2019 (2H) 2 2 0 2 3 
Accounts affected Domains affected 
2021 (1H) 2021 (1H) 
2020 (2H) 2020 (2H) 
2020 (1H) 2020 (1H) 
2019 (2H) 2019 (2H) 

0 2 4 6 8 0 2 4 6 8 

Conclusion 


Given the vast amount of information transiting our global network, Cloudflare is mindful of the 
special and sensitive position we occupy with regard to our customers and the responsibilities our 
customers have placed on us through their trust. While there has been a steady increase in the 
number of law enforcement requests since our first transparency report in 2013, this is due in part 
to the exponential increase in the number of Cloudflare customer domains during that time period. 
We will continue to publish this report on a semiannual basis. Please be advised that we may 
restate data as we go forward as more complete information becomes available or if we change 
our classifications. 
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